D.C. Law 22-269. Risk Management and Own Risk and Solvency Assessment Act of 2018.

AN ACT

To require an insurer to maintain a risk management framework and internal risk and solvency assessment, to submit a summary report relating to the risk and solvency assessment to the Commissioner of the Department of Insurance, Securities and Banking, and to authorize the Commissioner to share the information contained in the summary report with the National Association of Insurance Commissioners or other designated third party and to receive related information from regulatory agencies.

BE IT ENACTED BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this act may be cited as the "Risk Management and Own Risk and Solvency Assessment Act of 2018".

Sec. 2. Definitions.

For the purposes of this act, the term:

(1) "Commissioner" means the Commissioner of the Department of Insurance, Securities and Banking.

(2) "Department" means the Department of Insurance, Securities and Banking.

(3) "Holding Company System Act" means the Holding Company System Act of 1993, effective October 21, 1993 (D.C. Law 10-44; D.C. Official Code § 31-701 et seq.).

(4) "Insurance group" means those insurers and affiliates included within an insurance holding company system as defined in section 2(4) of the Holding Company System Act.

(5) "Insurer" means the same as provided in section 2(3) of the Annual Audited Financial Reports Act of 1993, effective October 21, 1993 (D.C. Law 10-48; D.C. Official Code § 31-301(3)); except, that it shall not include, agencies, authorities, or instrumentalities of the United States, its possessions and territories, the Commonwealth of Puerto Rico, the District of Columbia, or a state or political subdivision of a state.

(6) "Own Risk and Solvency Assessment" or "ORSA" means a confidential internal assessment appropriate to the nature, scale, and complexity of an insurer or insurance group, conducted by that insurer or insurance group, of the material and relevant risks associated with the insurer or insurance group's current business plan and the sufficiency of capital resources to support those risks.

(7) "ORSA Guidance Manual" means the current version of the Own Risk and Solvency Assessment Guidance Manual developed and adopted by NAIC.

(8) "ORSA Summary Report" means a confidential high-level summary of an insurer's or insurance group's ORSA.

(9) "NAIC" means the National Association of Insurance Commissioners.

Sec. 3. Risk management framework.

(a)(1) An insurer shall maintain a risk management framework, as described in the ORSA Guidance Manual, to assist the insurer with identifying, assessing, monitoring, managing, and reporting on its material and relevant risks.

(2) A change in the ORSA Guidance Manual shall be effective on the January 1 following the calendar year in which the changes are adopted by NAIC.

(b) The requirement set forth in subsection (a) of this section may be satisfied if the insurance group of which the insurer is a member maintains a risk management framework applicable to the operations of the insurer.

Sec. 4. ORSA requirement.

Except as provided in section 6, an insurer, or the insurance group of which the insurer is a member, shall conduct an ORSA using a process comparable to the applicable process contained in the ORSA Guidance Manual annually and any time there is significant change to the risk profile of the insurer or the insurance group of which the insurer is a member.

Sec. 5. ORSA Summary Report.

(a) Upon the Commissioner's request, and no more than once each year, an insurer shall submit to the Commissioner an ORSA Summary Report or any combination of reports applicable to the insurer or the insurance group of which it is a member that together contain the information described in the ORSA Guidance Manual ("reports"). If the insurer is a member of an insurance group, the insurer shall annually submit the reports required by this subsection to the lead state commissioner of the insurance group as determined by the procedures within the Financial Analysis Handbook adopted by the NAIC regardless of whether the Commissioner has made a request.

(b) The reports shall be signed by the insurer or insurance group's chief risk officer or other executive having responsibility for the oversight of the insurer's enterprise risk management process. The executive shall attest that to the best of the executive's belief and knowledge the insurer has applied the enterprise risk management process described in the ORSA Summary Report and that a copy of the report has been provided to the insurer's board of directors or the appropriate committee of the board.

(c) An insurer may comply with subsection (a) of this section by providing the most recent and substantially similar report provided by the insurer or another member of an insurance group of which the insurer is a member to the commissioner of another state or to a supervisor or regulator of a foreign jurisdiction; provided, that the report provides information that is comparable to the information described in the ORSA Guidance Manual; provider further, that a report in a language other than English shall be accompanied by an English translation of the report.

Sec. 6. Exemptions.

(a) An insurer shall be exempt from the requirements of this act if:

(1) The insurer has annual direct written and unaffiliated assumed premiums, including international direct and assumed premiums, but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of less than $500 million; and

(2) The insurance group of which the insurer is a member has annual direct written and unaffiliated assumed premiums, including international direct and assumed premiums, but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, of less than $1 billion.

(b) If an insurer qualifies for exemption pursuant to subsection (a)(1) of this section, but the insurance group of which the insurer is a member does not qualify for exemption pursuant to subsection (a)(2) of this section, then the ORSA Summary Report that may be required pursuant to section 5 shall include every insurer within the insurance group; which requirement may be satisfied by the submission of more than one ORSA Summary Report for any combination of insurers; provided, that the combination of reports includes every insurer within the insurance group.

(c) If an insurer does not qualify for exemption pursuant to subsection (a)(1) of this section, but the insurance group of which it is a member qualifies for exemption pursuant to subsection (a)(2) of this section, then the only ORSA Summary Report that may be required pursuant to section 5 shall be the report applicable to that insurer.

(d)(1) An insurer that does not qualify for exemption pursuant to subsection (a) of this section may apply to the Commissioner for a waiver from the requirements of this act based upon unique circumstances.

(2)(A) In deciding whether to grant an insurer's request for waiver, the Commissioner may consider:

(i) The type and volume of business written;

(ii) The ownership;

(iii) The organizational structure; and

(iv) Any other factor the Commissioner considers relevant to the insurer or insurance group of which the insurer is a member.

(B) If the insurer is part of an insurance group with insurers domiciled in more than one state, the Commissioner shall coordinate with the lead state commissioner and with other domiciliary commissioners of the other states in considering whether to grant the insurer's request for a waiver.

(e) Notwithstanding the exemptions stated in this section, the Commissioner may require an insurer to:

(1) Maintain a risk management framework, conduct an ORSA, and file an ORSA Summary Report based on unique circumstances, including the type and volume of business written, ownership, and organizational structure, and federal agency and international supervisor requests; or

(2) Maintain a risk management framework, conduct an ORSA, and file an ORSA Summary Report if:

(A) The insurer has risk-based capital for a Company Action Level Event, as defined in section 4 of the Risk-Based Capital Act of 1996, effective April 9, 1997 (D.C. Law 11-233; D.C. Official Code § 31-2003);

(B) Meets one or more of the standards of an insurer deemed to be in hazardous financial condition, as defined in section 2 of the Standards to Identify Insurance Companies Deemed to Be in Hazardous Financial Condition Act of 1993, effective October 21, 1993 (D.C. Law 10-43; D.C. Official Code § 31-2101); or

(C) As determined by the Commissioner, exhibits other qualities of a troubled insurer.

(f) If an insurer that qualifies for an exemption pursuant to subsection (a) of this section no longer qualifies for that exemption due to changes in premiums as reflected in the insurer's most recent annual statement or in the most recent annual statements of the insurers within the insurance group of which the insurer is a member, the insurer shall have one year following the loss of exemption qualification to comply with the requirements of this act.

Sec. 7. Contents of ORSA Summary Report.

(a) The ORSA Summary Report, and any additional requests for information, shall be prepared:

(1) In consistence with the ORSA Guidance Manual; and

(2) Using procedures consistent with section 8 of the Holding Company System Act and the Law on Examinations Act of 1993, effective October 21, 1993 (D.C. Law 10-49; D.C. Official Code § 31-1401 et. seq.).

(b) Documentation and supporting information shall be maintained for a period to be determined by the Commissioner and made available upon request of the Commissioner.

Sec. 8. Confidentiality.

(a) Documents, materials, or other information, including the ORSA Summary Report, ("ORSA-related information") in the possession or control of the Department that are obtained by, created by, or disclosed to the Commissioner or other person acting under the authority of the Commissioner shall be deemed by the District as proprietary, to contain trade secrets, confidential, and privileged, not subject to the Freedom of Information Act of 1976, effective March 25, 1977 (D.C. Law 1-96; D.C. Official Code § 2-531 et seq.), not subject to subpoena, and not subject to discovery or admissible in evidence in any private civil action.

(b) Notwithstanding subsection (a) of this section, the Commissioner may use the ORSA-related information in the furtherance of any regulatory or legal action brought as part of the Commissioner's official duties; provided, that the Commissioner shall not otherwise make the ORSA-related information public without the prior written consent of the insurer.

(c) Neither the Commissioner nor any other person acting under the authority of the Commissioner who has received ORSA-related information, through examination or otherwise, shall be permitted or required to testify in any private civil action concerning any ORSA-related information.

(d)(1) To assist in the performance of the Commissioner's regulatory duties, the Commissioner may:

(A) Upon request, share ORSA-related information with other District, state, federal, or international financial regulatory agencies, including members of any supervisory college in accordance with the Holding Company System Act, with NAIC, or a third-party consultant designated by the Commissioner; provided, that the recipient agrees in writing to maintain the confidentiality and privileged status of the ORSA-related information and verifies in writing that it has the legal authority to maintain the confidentiality and privileged status of the ORSA-related information under all applicable laws and regulations; and

(B) Receive ORSA-related information, including otherwise confidential and privileged documents, materials or information, from state, federal, or international financial regulatory agencies, including members of any supervisory college in accordance with the Holding Company System Act and from NAIC, and shall maintain as confidential or privileged any documents, materials, or information received with notice that it is confidential or privileged under the laws of the jurisdiction that is the source of the ORSA-related information.

(2) The Commissioner shall enter into a written agreement with NAIC or a third-party consultant ("recipient") governing the sharing and use of this information provided pursuant to this act, which shall:

(A) Specify procedures and protocols to be used to protect the confidentiality and security of information, and, in the case of an agreement with NAIC, including procedures and protocols for sharing the information with other state regulators from states in which an insurance group has domiciled insurers;

(B) Require the recipient to maintain the confidentiality and privileged status of the ORSA-related information or other information and to verify that the recipient has the legal authority to maintain confidentiality and privileged status of the ORSA-related information or other information under all applicable laws and regulations;

(C) Specify that the Commissioner retains ownership of the information and that the use of the information is subject to the direction of the Commissioner;

(D) Prohibit the recipient from storing the information in a permanent database after the underlying analysis is completed;

(E) Require the Department to give prompt notice to an insurer whose confidential information is in the possession of the recipient and is subject to a request or subpoena for disclosure or production in a judicial or administrative action;

(F) Require the recipient to consent to intervention by an insurer in a judicial or administrative action in which the recipient may be required to disclose confidential information about the insurer shared with the recipient; and

(G) In the case of an agreement with a third-party consultant, provide for the insurer's written consent.

(e) The Commissioner is solely responsible for the administration and execution of this act and sharing ORSA-related information by the Commissioner with another regulatory authority shall not constitute a delegation of regulatory authority.

(f) No waiver of any applicable privilege or claim of confidentiality in the ORSA-related information shall occur as a result of disclosure of the ORSA-related information to the Commissioner under this section or as a result of sharing the ORSA-related information, as authorized in this act. The ORSA-related information shall retain the confidential status specified in subsection (a) of this section notwithstanding its lawful disclosure to the Commissioner, NAIC, or a third-party consultant.

Sec. 9. Sanctions.

An insurer failing without just cause, as defined by the Commissioner by rule, to timely file an ORSA Summary Report required by this act shall, after notice and a hearing conducted according to the rules for contested cases set forth in Chapter 38 of Title 26 of the District of Columbia Municipal Regulations, be subject to a penalty in an amount not to exceed $1,000 per day. The maximum penalty assessed under this section shall be $25,000. The Commissioner shall recover this penalty.

Sec. 10. Rulemaking.

The Commissioner, pursuant to Title I of the District of Columbia Administrative Procedure Act, effective October 21, 1968 (82 Stat. 1204; D.C. Official Code § 2-501 et seq.), may issue rules to implement the provisions of this act.

Sec. 11. Fiscal impact statement.

The Council adopts the fiscal impact statement in the committee report as the fiscal impact statement required by section 4a of the General Legislative Procedures Act of 1975, approved October 16, 2006 (120 Stat. 2038; D.C. Official Code § 1-301.47a).

Sec. 12. Effective date.

This act shall take effect following approval by the Mayor (or in the event of veto by the Mayor, action by the Council to override the veto), a 30-day period of congressional review as provided in section 602(c)(1) of the District of Columbia Home Rule Act, approved December 24, 1973 (87 Stat. 813; D.C. Official Code § 1-206.02(c)(1)), and publication in the District of Columbia Register.